Enterprise-Grade Security

Security That Scales
With Your Startup

From your first user to your Series C, LiteSOC provides the threat detection, compliance tools, and forensic capabilities you need—without the enterprise complexity.

The Core Ingestion Engine

Your events, normalized. Your integrations, simplified. Real security in real-time.

Smart Event Normalizer

Stop wrestling with inconsistent log formats. LiteSOC automatically maps 40+ messy log formats into 26 Standard Security Events—giving you a unified view across your entire stack.

Messy Input
{
  "evt": "usr_login",
  "ok": true,
  "u_id": "12345",
  "ts": 1708934400000,
  "ip_addr": "192.168.1.1",
  "browser_info": "Chrome/121"
}
LiteSOC Standard
{
  "event_type": "user.login.success",
  "actor_id": "12345",
  "timestamp": "2024-02-26T12:00:00Z",
  "ip": "192.168.1.1",
  "user_agent": "Chrome/121",
  "geo": { "city": "SF", "country": "US" }
}

REST API First

2-Minute Integration

No heavy agents. No complex deployments. Just a simple REST API call from your existing codebase. Start tracking security events in minutes, not months.

// That's it. You're secure.
await litesoc.track({
  event_type: "user.login.success",
  actor_id: user.id,
  metadata: { method: "oauth" }
});
26
Standard Events
40+
Format Support
<50ms
Avg Latency

26 Standard Security Event Types

user.login.successuser.login.failureuser.logoutuser.createduser.deleteduser.password.changeduser.mfa.enableduser.mfa.disableduser.role.changeduser.session.createduser.session.revokedapi.key.createdapi.key.revokedpermission.grantedpermission.revokeddata.accesseddata.exporteddata.deletedsettings.updatedbilling.updatedsecurity.brute_forcesecurity.impossible_travelsecurity.geo_anomalysecurity.suspicious_ipsecurity.rate_limitedsecurity.unauthorized

Behavioral AI & Detection

Machine learning meets security. Detect threats humans miss, automatically.

Impossible Travel

If a user logs in from Tokyo and then London 10 minutes later, that's physically impossible. We calculate real-world travel speed using the Haversine formula to detect credential theft instantly.

Distance CalculationHaversine
Speed = Distance ÷ Time
Alert triggered if speed > 500 mph (impossible by commercial flight)

Geo-Anomaly Detection

We build a 30-day baseline of each user's login locations. When someone suddenly appears from a high-risk country, you'll know immediately.

High-Risk Countries Monitored
KPIRRUCNBYVESYCU

Brute Force Protection

Automated detection of password-guessing attacks with configurable thresholds based on your plan.

Basic Detection
Free Plan
20 attempts / 15 min
Advanced Detection
Pro & Enterprise
5 attempts / 5 min

How Our Detection Engine Works

Brute Force Detection

Real-time

Our brute force detection system monitors user.login.failure events in real-time, correlating them by user ID and IP address to identify credential-guessing attacks.

Detection Flow
1
Event Ingestion
Login failure event received with user_id and IP
2
Window Analysis
Count failures in sliding time window (5 or 15 min)
3
Threshold Check
Compare against plan-based limits (5 or 20 attempts)
4
Alert Generation
Create security.brute_force alert with full context
5
Notification
Instant alerts via Email, Slack, or Discord
Alert Payload
{
  "alert_type": "brute_force_attack",
  "severity": "high",
  "actor_id": "user_12345",
  "metadata": {
    "attempt_count": 12,
    "time_window_minutes": 5,
    "unique_ips": ["203.0.113.1", "203.0.113.2"],
    "first_attempt": "2024-02-26T14:00:00Z",
    "last_attempt": "2024-02-26T14:04:32Z"
  },
  "recommendations": [
    "Force password reset",
    "Enable MFA",
    "Review account activity"
  ]
}

Geo-Anomaly Detection

30-Day Baseline

We build a behavioral profile of each user's typical login locations over 30 days. When a login originates from a new country—especially one flagged as high-risk—an anomaly alert is triggered.

Detection Logic
1
Baseline Building
Track all login countries per user over 30 days
2
GeoIP Enrichment
Resolve IP → Country using MaxMind database
3
Country Check
Is this country in the user's baseline?
4
Risk Assessment
Check against high-risk country list (KP, IR, RU, etc.)
5
Severity Assignment
High-risk = critical, new country = high
High-Risk Countries

Logins from these countries automatically trigger critical-severity alerts:

🇰🇵
North Korea
KP
🇮🇷
Iran
IR
🇷🇺
Russia
RU
🇨🇳
China
CN
🇧🇾
Belarus
BY
🇻🇪
Venezuela
VE
🇸🇾
Syria
SY
🇨🇺
Cuba
CU

Impossible Travel Detection

Haversine Formula

If two logins from the same user occur from locations that would require traveling faster than commercial aircraft (500+ mph), the account is likely compromised.

The Math Behind It
Haversine Formula (Great-Circle Distance)
a = sin²(Δlat/2) + cos(lat₁) × cos(lat₂) × sin²(Δlon/2)
c = 2 × atan2(√a, √(1−a))
distance = R × c  // R = 6,371 km (Earth radius)
Speed Calculation
speed_mph = (distance_km / time_hours) × 0.621371

if speed_mph > 500:
    trigger_alert("impossible_travel")
Example Detection
Login #1: Tokyo, Japan
2024-02-26 14:00:00 UTC
Login #2: London, UK
2024-02-26 14:10:00 UTC
Distance: 9,571 km
Time Elapsed: 10 minutes
Required Speed: 35,537 mph
⚠️ IMPOSSIBLE - Alert Triggered
Live Route Visualization
Tokyo35.6895°N, 139.6917°ELondon51.5074°N, 0.1276°W9,571 km⚠️ 10 minutes
Tokyo
━━━9,571 km━━━
London
35,537 mph required

Map data © Mapbox © OpenStreetMap

Custom Threat Models

Enterprise

Enterprise customers can define custom detection rules tailored to their specific threat landscape. Create rules based on event patterns, metadata conditions, and time-based triggers.

Custom Rule Examples
Bulk Data Exporthigh
data.exported events > 5 in 1 hour
Admin Privilege Escalationcritical
user.role.changed to 'admin' outside business hours
API Key Rotation Stormmedium
api.key.created > 3 in 24 hours for same user
Suspicious Session Patternhigh
user.session.created from > 5 unique IPs in 1 hour
Rule Configuration
{
  "name": "Bulk Data Export Alert",
  "enabled": true,
  "conditions": {
    "event_type": "data.exported",
    "count": { "gte": 5 },
    "time_window": "1h",
    "group_by": "actor_id"
  },
  "severity": "high",
  "actions": [
    {
      "type": "alert",
      "channels": ["slack", "email"]
    },
    {
      "type": "webhook",
      "url": "https://api.yourapp.com/security"
    }
  ]
}

Visual Forensics & Network IQ

Every event tells a story. We help you read it with precision.

Deep Forensics Drawer

Click any event to open a detailed side-drawer with everything you need to investigate:

Precise Map Preview
Visual geolocation with street-level accuracy
Timeline Context
See events before and after
Full GeoIP Data
City, region, country, coordinates
Network Details
ISP, ASN, connection type

Network Intelligence

Every IP is enriched with network intelligence to flag suspicious sources.

VPN Detection
Flag commercial VPN providers
Proxy Detection
Identify anonymizing proxies
Tor Exit Nodes
Real-time Tor network detection
ISP & ASN Data
Provider information on every event

Enterprise Security & Compliance

Pass audits with confidence. Built for SOC 2, GDPR, and enterprise requirements.

SOC 2 Ready Audit Logs

50+ Actions

Every action in LiteSOC is logged with immutable audit trails. Export-ready for SOC 2 Type II, GDPR Article 30, and ISO 27001 audits.

Sample Audit Entry
{
  "action": "settings.api_key.regenerated",
  "actor_id": "user_123",
  "timestamp": "2024-02-26T14:32:00Z",
  "ip": "203.0.113.50",
  "changes": { "api_key": "[REDACTED]" }
}

Role-Based Access Control

Fine-grained permissions with 4 distinct roles. Control who sees what across your organization.

Owner
Full control including billing, team management, and danger zone actions
All permissions
Admin
Manage team members, configure settings, and view all data
Team + Settings + Data
Member
View and interact with security events and alerts
Events + Alerts
Viewer
Read-only access to dashboards and reports
Read Only

Authorized Origins (CORS)

Control exactly which domains can send events to your LiteSOC instance. Supports wildcard subdomains for dynamic environments.

Strict origin validation
Wildcard subdomain support *.example.com
Plan-based limits (1 / 5 / Unlimited)

IP Whitelisting

Enterprise

Silence noise from trusted sources. Whitelist your office IPs, CI/CD servers, or internal infrastructure using CIDR notation.

Example CIDR Ranges
192.168.1.0/2410.0.0.0/8203.0.113.50/32

The Developer Ecosystem

Built by developers, for developers. Integrate in minutes with your favorite tools.

Multi-Language SDKs

Official SDKs for the most popular backend languages. Type-safe, well-documented, and actively maintained.

Node.js
npm i litesoc
Python
pip install litesoc
PHP
composer require litesoc/litesoc

One-Click Integrations

Get alerted where your team already works. Native integrations with secure webhook signing.

Slack
Rich alert cards with action buttons
Pro
Discord
Embedded alerts for gaming & community apps
Pro
Custom Webhooks
HMAC-SHA256 signed payloads
Pro

Ready to secure your SaaS?

Join thousands of developers who trust LiteSOC to protect their applications. Start your 14-day Pro trial today—no credit card required.

No credit card required • Full Pro features • Cancel anytime